IOC Report
https://smarsh.my.site.com/messagingsandbox

Files

File Path

Type

Category

Malicious

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:21:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:21:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:21:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:21:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 14:21:57 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide

dropped

Chrome Cache Entry: 100

PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced

downloaded

Chrome Cache Entry: 74

GIF image data, version 89a, 48 x 48

downloaded

Chrome Cache Entry: 78

gzip compressed data, max compression, original size modulo 2^32 46274

downloaded

Chrome Cache Entry: 79

HTML document, ASCII text, with CRLF, LF line terminators

downloaded

Chrome Cache Entry: 80

GIF image data, version 89a, 1 x 49

downloaded

Chrome Cache Entry: 82

ASCII text

downloaded

Chrome Cache Entry: 84

GIF image data, version 89a, 48 x 48

downloaded

Chrome Cache Entry: 86

HTML document, ASCII text

downloaded

Chrome Cache Entry: 89

ASCII text

downloaded

Chrome Cache Entry: 91

ASCII text, with no line terminators

downloaded

Chrome Cache Entry: 93

GIF image data, version 89a, 159 x 49

dropped

Chrome Cache Entry: 94

HTML document, ASCII text

downloaded

Chrome Cache Entry: 96

ASCII text

downloaded

Chrome Cache Entry: 97

HTML document, ASCII text

downloaded

Chrome Cache Entry: 99

GIF image data, version 89a, 1 x 1

downloaded

There are 12 hidden files, click here to show them.

URLs

Name

IP

Malicious

https://smarsh.my.site.com/messagingsandbox

http://smarsh.mysite.com/cgi-bin/css/new_style.css?partner=mysite.com

64.136.20.37

http://smarsh.mysite.com/favicon.ico

64.136.20.37

https://smarsh.my.site.com/messagingsandbox/s/

http://www.communityarchitect.com/fs_img/footer/spacer.gif

64.136.20.68

http://signup.mysite.com/cgi-bin/path/signup?verify=1713540177

http://signup.mysite.com/fs_img/js/CGI/Ex/validate.js

64.136.20.55

http://signup.mysite.com/fs_img/js/pt.js

64.136.20.55

http://smarsh.mysite.com/

http://signup.mysite.com/fs_img/spacer.gif

64.136.20.55

http://signup.mysite.com/fs_img/cgi/signup.gif

64.136.20.55

http://smarsh.mysite.com/cgi-bin/show_me

http://signup.mysite.com/favicon.ico

64.136.20.55

http://smarsh.mysite.com/fs_img/cgi/html_parser.gif

64.136.20.37

http://smarsh.mysite.com/cgi-bin/image/logo_small.gif?partner=mysite.com

64.136.20.37

http://signup.mysite.com/cgi-bin/image/logo_small.gif?partner=mysite.com

64.136.20.55

http://signup.mysite.com/cgi-bin/css/new_style.css?partner=mysite.com

64.136.20.55

http://members.mysite.com/cgi-bin/image/logo_small.gif

64.136.20.37

http://smarsh.mysite.com/fs_img/js/pt.js

64.136.20.37

http://signup.mysite.com/cgi-bin/path/signup

64.136.20.55

There are 9 hidden URLs, click here to show them.

Domains

Name

IP

Malicious

signup.mysite.com

64.136.20.55

Details

Name:	signup.mysite.com
IP:	64.136.20.55
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

108.177.122.103

members.mysite.com

64.136.20.37

Details

Name:	members.mysite.com
IP:	64.136.20.37
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

www.communityarchitect.com

64.136.20.68

Details

Name:	www.communityarchitect.com
IP:	64.136.20.68
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

smarsh.mysite.com

64.136.20.37

Details

Name:	smarsh.mysite.com
IP:	64.136.20.37
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol

smarsh.my.site.com

unknown

Details

Name:	smarsh.my.site.com
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

IPs

IP

Domain

Country

Malicious

64.233.177.94

unknown

United States

1.1.1.1

unknown

Australia

23.48.105.206

unknown

United States

142.250.105.102

unknown

United States

192.168.2.16

unknown

unknown

173.194.219.138

unknown

United States

64.136.20.37

members.mysite.com

United States

64.136.20.68

www.communityarchitect.com

United States

239.255.255.250

unknown

Reserved

173.194.219.139

unknown

United States

64.233.177.101

unknown

United States

142.250.9.94

unknown

United States

64.233.185.84

unknown

United States

23.48.105.198

unknown

United States

74.125.138.95

unknown

United States

64.136.20.55

signup.mysite.com

United States

108.177.122.103

www.google.com

United States

There are 7 hidden IPs, click here to show them.